Vendor Supply Chain Analyst

Oneleet (Yc S22); United States; Remote; USD 70,000 - 110,000; Full time

Job summary

Oneleet seeks a Vendor Supply Chain Analyst to verify AI-generated vendor research and ensure evidence supports conclusions. You will check findings against saved sources, resolve gaps, and improve the AI research pipeline for reliability.

You will tackle a backlog of 500–600 vendors, prioritizing by customer usage, building a solid vendor library, and documenting sources for auditability at scale.

Qualifications

• Hands-on experience conducting vendor security due diligence or third-party security assessments.
• Strong research skills and the judgment to distinguish evidence from marketing claims.
• Familiarity with SaaS security practices and public security, privacy, and compliance documentation.
• An analytical mind.

Responsibilities

• Verify vendor research by checking AI findings against saved sources and prioritizing vendors by customer use.
• Build and maintain the vendor library, researching new SaaS vendors and flagging changes.
• Resolve source-access gaps by finding accessible sources or uploading documents.
• Confirm public security claims (SSO, DPAs, subprocessor lists, SOC 2 reports).
• Measure accuracy and calibrate scoring by comparing to customer ratings.
• Improve research quality by documenting errors and feeding back to engineering.
• Recommend criteria updates as vendor practices evolve.
• Maintain defensible evidence with dates and sources for auditability.
• Develop verification runbooks with repeatable review steps.

Skills

Vendor security due diligence

Research skills

SaaS security knowledge

Analytical mind

Job description

About Oneleet

Oneleet is one of the fastest-growing security and compliance platforms in history. We are on a mission to change the compliance and security industry by making cybersecurity and compliance effective, easy, and painless. We provide a platform that helps companies build, manage, and monitor their cybersecurity programs and achieve compliance standards such as SOC 2 and ISO 27001 efficiently, without cutting corners.

Having just raised a $33 million Series A , we are rapidly growing in customers and employees. Our team has decades of experience in security and compliance. Join our team of opinionated rebels and help us build a category-defining company reshaping the broken and fragmented compliance and cybersecurity industry.

Who we're looking for:

We value passionate self-starters with a growth mindset and a bias for action and personal accountability. If you love solving hard problems, thrive in ambiguity, and want to make a real impact, you'll fit right in.

We're especially drawn to:

• Rebels with a cause - frustrated with the status quo and eager to disrupt it.


• Opinionated (but not obstinate) builders - decisive yet collaborative, who help us move fast.


• Clear communicators - who own their ideas and follow through.

Our mission is simple: make effective cybersecurity painless.

We believe cybersecurity should empower, not burden. This belief unites our team and drives every decision we make.

If you're ready to challenge the status quo and help shape the future of cybersecurity, we'd love to meet you.

The Role

Oneleet helps customers understand the security posture of the vendors they use without repeating the same research for every company. Our shared vendor library brings together findings from public sources so customers can make informed decisions faster.

As our Vendor Supply Chain Analyst, you'll help build and maintain that library. Your core responsibility is verifying AI-generated research: checking findings against saved sources, resolving gaps, and making sure the evidence supports the conclusions. Engineering owns the AI research pipeline; you'll provide the feedback that makes its output more accurate and useful.

Each shared vendor record has a security posture score. Customer-specific risk scores are calculated separately using each customer's exposure to that vendor. Your work ensures the underlying vendor research is reliable.

Preliminary research results appear immediately. Human verification follows, with a target turnaround of 1-2 days. The pipeline automatically re-researches vendors every 90 days and routes significant changes for human review.

You'll help work through an initial backlog of approximately 500-600 vendors, prioritizing those used by the most customers. You'll also help establish how we measure research accuracy and compare computed scores with existing customer-assigned ratings. This is an opportunity to shape how Oneleet evaluates vendor security at scale.

Key Responsibilities

• Verify vendor research. Check AI-generated findings against saved sources, prioritizing vendors by how many customers use them. Correct unsupported claims and distinguish supported findings from missing or inconclusive evidence.


• Build and maintain the vendor library. Research new SaaS vendors, resolve incomplete records, and review significant changes flagged by the pipeline, including breaches and changes to security practices.


• Resolve source-access gaps. When the pipeline cannot fetch a page or encounters a login barrier, find an accessible source or manually upload an available document.


• Confirm public security claims. Verify evidence for criteria such as SSO availability, published DPAs, subprocessor lists, and whether a SOC 2 report exists.


• Measure accuracy and calibrate scoring. Evaluate research accuracy during the proof of concept and beyond. Compare computed scores with existing customer-assigned ratings, investigate differences, and recommend adjustments where the evidence supports them.


• Improve research quality. Document recurring errors, missed evidence, and ambiguous results, then give engineering actionable feedback to improve the AI pipeline.


• Recommend criteria updates. Identify gaps or unclear definitions in the evaluation criteria and propose changes as vendor practices and security expectations evolve.


• Maintain defensible evidence. Keep findings traceable to saved sources, with clear reasoning and research dates, so customers and auditors can understand the basis for a finding months later.


• Develop verification runbooks. Document repeatable review steps and escalation paths that help the team make consistent decisions.

You Might Be a Good Fit If You Have

• Hands-on experience conducting vendor security due diligence or third-party security assessments.


• Strong research skills and the judgment to distinguish evidence from marketing claims.


• Familiarity with SaaS security practices and public security, privacy, and compliance documentation.


• An analytical mind